01 Import a Subscription and Enable the Configuration
Copy the URL and Add a Remote Configuration
Open your service provider's subscription management page and find the subscription option for Clash or mihomo. Use the page's Copy button. Don't copy the account management page URL from your browser's address bar, and don't include any sharing instructions. If several formats are available, choose one explicitly marked as compatible with your client. A link intended for another app may not import correctly.
Return to the client and open the “Configuration” or “Subscription” page. Look for “New,” “Add,” or “Import from URL.” Choose the remote URL option, paste the copied address into the URL field, and enter a name that's easy to recognize, such as “Daily setup.” The name is for local reference only and won't change how the connection works. Check that there are no spaces or line breaks at either end of the URL, then select “Import,” “Download,” or “Save.”
Wait for the download to finish. Check that a new configuration card appears, along with a recent update time or an import confirmation. Some clients require you to click Update after saving the URL. A name appearing in the list doesn't necessarily mean the configuration has downloaded. For your first import, keep the client's default update settings; there's no need to change headers, update intervals, or other advanced fields.
Select the Configuration and Check That It Loaded
Select “Use,” “Enable,” or the selection indicator next to the new configuration to make it active. Then open the Proxies page and check for policy groups and their options. A policy group is a set of choices that rules use to select an exit route; it may contain individual nodes, an automatic selection group, or other policy groups. If the configuration appears in the list but the Proxies page is still empty, return to the Configuration page and make sure it is enabled before adding the same URL again.
If you have a YAML file, choose “Import from file,” locate the file, and enable it. YAML is a text format that uses indentation to show structure; don't resave it as rich text in an office app. The file may contain only nodes or a complete set of rules. Whether it works on its own depends on whether the client can fill in missing parts. If the format isn't compatible, ask your provider for a complete configuration for your client rather than editing the file blindly.
If the download fails, first check that regular websites load. Then copy the URL again and check whether your account is still active or the subscription URL has been reset. An error or login page might be downloaded as a file, causing a configuration parsing error. Don't assume this means the nodes are broken. Stay at the import step while you troubleshoot: see installation and setup in the FAQ, or go to Troubleshooting if the issue persists.
Done when: The configuration is selected, and the Proxies page shows the policy groups provided by your subscription. Next, decide how to use those policies before routing device traffic through the client.
02 Choose a Rule Mode and Proxy
Start with Rule Mode
Open the home screen, dashboard, or proxy settings and find “Mode.” Choose “Rule.” In rule mode, the rules in your configuration determine whether each request uses a proxy, connects directly, or is handled another way. It's a good choice for your first connection: your configuration already defines how traffic is routed, so you don't need to send every request through the same exit just to load a website.
Knowing the other two modes can help prevent mistakes. “Global” usually sends requests through the exit selected in the global policy group, but it doesn't automatically route apps the client hasn't taken over. “Direct” usually sends traffic without a proxy node. Mode controls how the core handles requests once they reach it; it doesn't turn the system proxy on or off. Switching to Global alone won't make the browser use the client if traffic routing isn't enabled.
Choose an Available Node in a Policy Group
Open the Proxies page, expand the main proxy policy group, and select an available node from your provider. Group names vary between subscriptions, so don't look for a button specifically named PROXY; use the available options and configuration notes to identify the right group. If the main group points to another manual selection group, expand that one too and make sure the final selection isn't Direct by mistake. An automatic selection group picks an available exit based on the test criteria in the configuration, so you don't need to switch options one by one.
You can use the client's connectivity test to rule out options that clearly fail, but don't judge access to every website by a single test. The test target may differ from the site you want to visit, and a successful test doesn't mean every rule is configured correctly. Pick one option and watch a real request in the verification steps below. Constantly switching nodes from the start makes it harder to tell which setting caused the result.
For now, don't add custom rules, change DNS settings, or combine multiple subscriptions. DNS translates domain names into network addresses; its settings can affect later routing decisions, but you don't need to adjust them manually for your first connection. Start with the subscription's settings and the client's compatible defaults, and investigate only if a specific issue comes up. To understand how nodes, policy groups, rules, and the core fit together, see the glossary. There's no need to read the full configuration reference at this stage.
Done when: Rule mode is selected, and the main proxy policy group has a clear exit option. Your configuration and proxy are ready; you can now let apps on your device connect.
03 Enable the System Proxy or Connect on Mobile
Desktop: Start the Core, Then Enable the System Proxy
Return to the client's home screen and confirm that the core is running. The core reads the configuration, matches rules, and forwards requests; the graphical interface just provides controls. An open window doesn't necessarily mean the core has started. If the home screen has a Start button, click it and wait for the status to show that it's running before enabling “System Proxy.” Some clients start the core automatically, in which case just confirm its status.
The system proxy adds the local proxy address to your operating system settings for apps that follow those settings. If the system asks to change network settings or grant service permissions, check the app name and approve only if the request came from the client you just installed. For your first test, turn off other proxy clients and browser proxy extensions to prevent them from overriding each other's settings. Keeping just one tool responsible for routing traffic makes it easier to see where requests are going.
Don't enable TUN at the same time yet. TUN routes network traffic through a virtual network interface. It can help with apps that don't use the system proxy, but it also involves permissions, routing, and DNS. Test your browser using the system proxy first. If an app doesn't follow the system proxy, check the client documentation to decide whether to enable TUN. The two methods can work together with specific configurations, but that isn't a good starting point for first-time troubleshooting.
If you're using the mihomo command-line core on Linux rather than a graphical client, running mihomo usually won't set the system proxy for your desktop environment. Enter the local proxy address and actual port in your system's network settings, or configure the app to use the proxy explicitly. The snippet below illustrates the field only; it doesn't include nodes or rules and cannot replace your subscription file as a complete connection configuration:
mixed-port: 7890
allow-lan: false
mode: rule
log-level: infomixed-port is the local port that accepts both HTTP and SOCKS proxy requests. The 7890 shown in this guide is only an example; use the listening port displayed by your client. The local address is usually 127.0.0.1. For first-time use, leave local network access disabled. You don't need to enable “Allow LAN” to connect your browser on the same device.
Mobile: Tap Connect and Approve the System Prompt
On the home screen of your Android or iOS client, tap “Connect” or the start button. The first time, your system will ask whether to allow a VPN configuration or connection; follow the prompt to approve it. Return to the client and check that the button shows Connected and that the system displays the corresponding connection status. If another VPN is using the same kind of traffic-routing capability, disconnect it before connecting this client.
Keep the client running, then open your browser to test the connection in the next step. If the connection drops only after the screen turns off, background restrictions may be the cause. There's no need to change every battery setting on your first connection; first confirm that browsing works while the screen is on and the app is in the foreground, then address background restrictions if needed.
Done when: On desktop, the core is running and the system proxy is enabled; on mobile, the client shows Connected. This confirms the connection is on, but you still need a real request to verify the full route.
04 Check That Requests Use the Expected Route
Make a New Request in Your Browser
Open your browser and visit a website you can normally access directly, then visit one that should use a proxy according to your subscription's rules. Use a new tab and refresh the page to make a fresh request instead of relying on cached content. The first site checks that your basic connection still works; the second checks that the proxy exit is available. One website alone can't confirm that both direct and proxy routing are working as expected.
Next, open the client's “Connections” or “Logs” page and find the domain you just visited. Check the matched rule and the final policy. Labels vary by client; focus on whether the request appears, the rule matches your expectations, and the exit isn't accidentally set to Direct or Reject. The details shown may differ when using TUN or special DNS settings. For your first test, focus on browser requests routed through the system proxy instead of trying to match every field exactly.
A public IP lookup can provide a useful clue, but it isn't conclusive. In rule mode, the lookup site itself may use a direct connection, so an unchanged result alone doesn't prove the proxy is broken. Conversely, a changed IP doesn't prove that every app is being routed through the client. Compare the website result with the request record in the client to pinpoint whether the issue is with the connection, rules, or proxy exit.
Use Commands to Check the Local Port and Terminal Setup
To test the local proxy endpoint, use the command below if curl is installed on your system. In Windows Terminal, use curl.exe to call the program explicitly. Replace the port in the command with the client's actual HTTP or mixed port. You can also change the test URL to the site you want to check.
curl --proxy http://127.0.0.1:7890 --head --connect-timeout 10 https://example.comThis command explicitly specifies the proxy, so it doesn't depend on whether your terminal reads the system proxy settings. Receiving HTTP response headers means a request made it through the local endpoint, but the site may return a redirect or an error status rather than a successful page. This alone doesn't prove that the request went through a remote proxy node: the rules may still choose Direct. Check the client's connection records to confirm the final exit.
If the connection to 127.0.0.1 fails, first check that the core is running and that you entered the correct port; don't reset the subscription yet. If the port connects but requests keep timing out, check the selected node and the logs. If the browser works but a regular terminal request doesn't, the terminal may not read the system proxy settings; there's no need to keep reinstalling the client. For environment variable setup and further diagnostics, see Troubleshooting. This guide uses an explicit proxy test to avoid changing your entire terminal environment.
Disconnect and Keep a Way to Restore Your Settings
After verifying the connection, note the configuration name, selected policy, and traffic-routing method. When you need to make adjustments, change one thing at a time and test a new request after each change. When sharing diagnostic details, you can include the client name, system version, and error message, but redact subscription URLs, account details, and access credentials in your configuration. Don't upload the entire configuration file.
When you're done on desktop, disable the system proxy before quitting the client. On mobile, disconnect first. Some clients minimize to the system tray when you close the window; that doesn't quit the app or stop traffic routing. If regular websites stop loading after you quit, check whether the system proxy still points to a local port that's no longer listening. Turn off any leftover proxy setting and test your basic connection; there's no need to reinstall your operating system or delete all your configurations.
Done when: Your browser can access websites, the client's request records explain how traffic was routed, and your basic connection works again after you quit. Your initial setup is complete. For everyday updates and common tasks, see the FAQ. If you run into a specific issue, check the relevant symptom in Troubleshooting.